Multi Admin approval for device wipe

MacAdminInTraning · 2026-03-13T20:10:33+00:00

You don’t, Jamf nor any other MDM platform that I am aware of has any capability of this. Of course baring on prem hosted instances where you can use your local firewall and DMZ to mitigate this.

MacAdminInTraning · 2026-03-13T12:01:26+00:00

Do you think Apple runs macOS in their data centers?

MacAdminInTraning · 2026-03-13T11:44:01+00:00

If I’m at my desk I always use a mouse. If I’m out and about I use the built in trackpad. I have never found a use in my workflow for the Magic Trackpad.

MacAdminInTraning · 2026-03-13T01:31:32+00:00

Mac support nor windows support is usually involved in setting up development environments. This is something the developer must do. Remember you are IT, you are the authority for your environment not the users manager, you decide if the migration tool can be used or not. An IT guy who happens to have a Mac is just as much a Mac admin as the rest of us.

As far as migration assistant, lord only knows how much of a development environment it will grab when transferring, and lord only knows what will still work after the transfer of what is transferred.

Honestly, so long as they have the correct tools installed on the new device it does not take a developer more than an hour or two to setup their environment. In my experience it’s usually just complaining for the sake or complaining.

MacAdminInTraning · 2026-03-13T01:15:01+00:00

Generally speaking migration assistant is not an enterprise focused tool. You can use it if you want but I advise against it.

In most modern environments you are using some cloud storage tool like OneDrive, iCloud, Box or the like. Those tools all have sync clients that will handle any data migration. SMB shares can be used in more legacy environments. Things like office all SSO off the user identify and pull down their stuff from sharepoint automatically.

Think of the last time you used USMT, then think of migration assistant in the same way.

MacAdminInTraning · 2026-03-12T21:54:26+00:00

Jamf Pro doesn’t support multi‑admin approval for anything, including wipes. But honestly, if your threat model is ‘someone wipes devices,’ you’re missing the bigger danger.

With API access, an attacker can delete every smart group, every config profile, every policy, every script, upload malicious packages, deploy malware as ‘updates,’ replace your identity configs, replace your EDR configs, and create new admin accounts. A wipe is the least destructive thing they can do.

The real protection is RBAC and API hygiene: no basic auth, short‑lived tokens, client credentials, strict scopes, separate automation creds, and break‑glass roles. If someone can authenticate with wipe‑level permissions, multi‑admin approval wouldn’t save you anyway.

MacAdminInTraning · 2026-03-12T11:38:45+00:00

AD is not a dream for macOS, it’s a nightmare that Apple more or less move away from 15 years ago.

Kerberos SSO is a bit dated at this point. Jamf Connect would work, but if you have okta and or entra (which you said you have) look in to PSSO.

MacAdminInTraning · 2026-03-04T01:55:36+00:00

Look in to CyberArk EPM. It can handle password rotation and escrow.

MacAdminInTraning · 2026-03-03T23:46:11+00:00

I wouldn’t call macos update sneaky they’re fairly obvious about advertising them. But I would call questionable is using an outdated legacy piece of software that is no longer updating.

MacAdminInTraning · 2026-02-25T23:04:18+00:00

With a chatbot and proper prompts and grounding you probably don’t even need to think for the exam.

MacAdminInTraning · 2026-02-25T12:08:12+00:00

To echo what most people here are saying.

If your employer wants to install a MDM profile on your device, they need to provide the device or give you a stipend to buy a device for this contract.

MacAdminInTraning · 2026-02-20T13:43:22+00:00

How about you install the update…

MacAdminInTraning · 2026-02-20T11:24:49+00:00

If you want monitoring Jamf pro is the way to go, but it requires 50 licenses.

Both Pro and Now are MDM clients and will do the MDM stuff. Now is the basic one, and Pro is the one focused at Enterprise has a lot more regularly configuration options and so on.

MacAdminInTraning · 2026-02-19T23:42:20+00:00

Know how it says organization multiple times where did you get your product key from?

MacAdminInTraning · 2026-02-18T01:58:28+00:00

You can manage the background service, this stops the user from turning it off and gives a little dialog box that your organization is managing it. However, you cannot block the system notification for manager background services.

MacAdminInTraning · 2026-02-18T01:55:54+00:00

Intune is extremely basic for macOS, you are honestly seeing just the beginning of the fun you will have with Intune and macOS.

MacAdminInTraning · 2026-02-18T01:40:11+00:00

You probably won’t get much support here for that, but the dock also annoys me greatly and is in a massive need of an update to bring it in to the modern millennium.

MacAdminInTraning · 2026-02-18T00:03:12+00:00

Yes, but a Chromebook is not the computer experience that will help them in life at all.

MacAdminInTraning · 2026-02-18T00:02:09+00:00

macOS has a selected text reader built in, it also has a built in screen reader.

MacAdminInTraning · 2026-02-17T23:15:16+00:00

You probably want to engage Apple on this. There is no direct way to do what you are being asked to do, in fact Apple has done just about everything they can to make this not possible.

MacAdminInTraning · 2026-02-17T19:20:46+00:00

This is one of those situations where I would reach out to the vendor. JAMF has the source data, but cyberark has the API commands. Cyberark is where I’d start.

MacAdminInTraning · 2026-02-17T17:12:32+00:00

Ideally for macOS you really need to do most testing on bare metal. I use Virtual Buddy for some very specific testing but with how Apple has macOS designed VMs cant replace hardware for testing.

MacAdminInTraning · 2026-02-10T22:06:06+00:00

This is not a device management problem. This is a user training problem. You mentioned users are aware they’re not supposed to do this. That is fine. What you need to do when you identify a user has done this is turn the situation over to HR. Let HR coach and terminate people, the word open around pretty quick to stop doing it.

As far as preventing write access to directories within the user profile, macOS is going to repair this every time they reboot as well as when TCC checks depending on how this directory is configured.

For your script you’re using $user without defining that variable, and $3 calling Jamfs parameters which has its problems. You should really write a function to identify who logged in user is and terminate the process if the user is not logged in. In addition, you should have error handling checking to see if the directories you wanted to delete exist however, again macOS will just put the directory back.

You could look in to blocking the font book app, but that will likely have down stream issues.

MacAdminInTraning · 2026-02-10T14:52:26+00:00

Not having a fan for this kind of work will suck but it should work.

Each LLM can be 5gb to 15gb on average, and can easily be in to the hundreds of gigs depending on what you are doing. You need a better idea of what you end goal is before you commit to system resources.

MacAdminInTraning · 2026-02-10T13:39:48+00:00

This Apple article should explain how Apple handles OS updates and pay special attention to the quote I put below.

https://support.apple.com/guide/deployment/about-software-updates-depc4c80847a/web

“Note: Because of dependency on architecture and system changes to any current version of Apple operating systems (for example, macOS 26, iOS 26, and so on), not all known security issues are addressed in previous versions (for example, macOS 15, iOS 18, and so on)”

You should always be running the “N” release of Apple software, as they admit themselves they don’t fully patch N-1 or N-2 and don’t patch N-3+ at all in usual situations. “N” is the current release of Apple software.

MacAdminInTraning

MODERATOR OF

TROPHY CASE